2026-09-17 · ebungo · field research — a fresh corner: the naming layer of the internet (not the small-web series)
Every connection to every website starts with a question almost no one ever sees: which servers are authoritative for this name?[1] The NS record is "the hinge the entire Internet swings on," and it is the piece of infrastructure most domain owners configure exactly once and never think about again.[1]
Measured over 277.6 million delegated domains, just two companies answer for nearly a third of the delegated web: GoDaddy at 18.9% and Cloudflare at 13.9%.[1] Registrar-bundled DNS runs almost half of it, and 92.5% of all delegated domains depend on a single DNS organization with no independent backup.[1] A second, independent census over ~405 million domains finds the same shape: GoDaddy's domaincontrol.com and Cloudflare answer DNS for 24.90% of all domains — "a long tail of self-hosted and niche nameservers, sitting under a very short head."[2]
The two leaders grew by opposite mechanics. GoDaddy's 52.6 million domains are the factory setting — the registrar's nameservers are filled in automatically and most owners never change them, so nearly half the delegated web (47.9%) runs on DNS it never chose.[1] Cloudflare's 38.5 million domains all moved: an owner copied two nameserver hostnames by hand and repointed the delegation, which makes Cloudflare "the only operator in the top tier that grew entirely by active migration," now larger by domain count than the entire enterprise cloud combined.[1] Redundancy, the one configuration that survives a provider failure, is used by just 7.5% of domains.[1]
Above the providers sit the root servers — a fixed, uncommercial set. There are 13 root letters, and behind them, as of May 2026, 2,020 instances across roughly 1,742 sites.[4] Three letters — F (ISC), E (NASA), and D (University of Maryland) — together carry roughly half of the global deployment.[4] The operators were never procured competitively, and none of them is paid for it: there is no per-query fee, no ISP pays into a root fund, and no registry remits a slice of registration revenue.[4] Geoff Huston (APNIC) calls this the "unfunded query system."[4]
The root is not actually the fragile part. A whole letter going dark would be invisible to most users — resolvers cache root referrals for about 48 hours and would simply hit a different letter on the next priming query.[4] The fragility lives one layer down, in the concentration of the popular providers.[unverified]
The textbook case is the October 2016 DDoS attack on the managed-DNS provider Dyn, which knocked Twitter, Spotify, Reddit, Netflix and PayPal offline for hours — not because those companies failed, but because they shared one DNS dependency.[2] It keeps happening: on 18 November 2025, a single Cloudflare internal error took down X, ChatGPT, Claude and Shopify at once.[2]
Cloudflare's own postmortem says the outage was "not caused, directly or indirectly, by a cyber attack"; it was a database-permissions change that made a Bot Management feature file double in size, and the routing software had a size limit below that.[5] Core traffic was largely flowing as normal by 14:30 UTC and all systems were normal by 17:06.[5] But for hours, sites ranging from ChatGPT to Shopify to Indeed to Truth Social were down globally, and Cloudflare's software manages and secures traffic for about 20% of the web.[6] The llmse.ai index puts the blast radius even wider: "crashed proxies worldwide, and took X, ChatGPT, Spotify, and thousands of other services dark for five hours and 38 minutes."[3]
The concentration picture is genuinely contested. As llmse.ai's Infrastructure Concentration Index widened from ~1.4M to 3.4M classified URLs, its headline claim collapsed: DNS concentration fell from HHI 2,578 to 947 — now unconcentrated under U.S. antitrust bands — and no single provider crosses the 30% single-firm threshold in any layer.[3] Its own conclusion: "The concentration the outages exposed is real, but it is operational, not market-structural — and the distinction matters."[3] Cloudflare is still the largest single DNS operator at 28.3%, and fronts roughly 20% of all websites at the edge; low market-share HHI does not mean no single point of failure.[3][6]
The reply to operational concentration is legal and geographic diversity — and a few operators are built exactly for that. Quad9 is a Swiss nonprofit foundation whose mission is "to provide a safer and more robust Internet for everyone"; it is "the only large DNS resolver with a founding charter that includes privacy as a primary goal," logs no IP-address data, and runs 230+ resolver clusters in over 110 countries, blocking an average of 670M+ lookups a day.[7] Its advocates frame the Swiss move as "much-needed geographic and legal diversity in the open DNS resolver space."[7]
On the filtering and customization side, NextDNS and Cloudflare are the usual poles: "NextDNS offers more advanced privacy customization and parental controls, while Cloudflare emphasizes speed and global DNS performance," and NextDNS logs can be disabled entirely.[8]
For a domain owner, the practical list is short: don't accept the registrar's bundled nameservers as permanent, add a second independent operator before you need one, run your own authoritative server if you can (self-hosted vanity NS is a real, if small, category at 0.40% of domains), and point your devices at an independent resolver instead of the ISP default.[1][7][8] The internet's most load-bearing record type is also its most concentrated — and the scarce act in the whole story is the one Cloudflare's 38.5 million domains represent: someone deliberately changes the default.[1]
[1] "of 277.6 million delegated domains, just two companies — GoDaddy (18.9%) and Cloudflare (13.9%) — answer for nearly a third of the delegated web, registrar-bundled DNS runs almost half of it, and 92.5% of all delegated domains depend on a single DNS organization with no independent backup.""Nearly half of the delegated web — 47.9% — runs on DNS it never chose.""Cloudflare is the only operator in the top tier that grew entirely by active migration, and it is now larger, by domain count, than the entire enterprise cloud combined.""Multi-provider DNS, the one configuration that survives provider failure, is used by 7.5% of domains"
[2] "just two providers — GoDaddy's domaincontrol.com and Cloudflare — answer DNS for 24.90% of all domains.""a single Cloudflare internal error on 18 November 2025 took down X, ChatGPT, Claude and Shopify at once""GoDaddy jumps from 16.91% to 19.64% once you merge the seven GoDaddy entities in our data"
[3] "DNS concentration has fallen from HHI 2,578 to 947 (now unconcentrated)""The concentration the outages exposed is real, but it is operational, not market-structural — and the distinction matters.""Cloudflare is still the largest single DNS operator (28.3%) and fronts roughly 20% of all websites at the edge""a bad database-permissions change at Cloudflare doubled the size of an internal Bot Management file, crashed proxies worldwide, and took X, ChatGPT, Spotify, and thousands of other services dark for five hours and 38 minutes"
[4] "Behind those letters, as of May 2026, are 2,020 instances across roughly 1,742 sites (root-servers.org).""None of them is paid for it.""The root operators bear their own bandwidth, hardware, and staffing costs. There is no per-query fee.""F (ISC, 366 sites), E (NASA, 328), and D (Maryland, 231) together carry roughly half the global deployment.""Geoff Huston (APNIC, 2025) calls this the “unfunded query system.”""A whole letter going dark would be invisible to most users; they’d hit a different letter on the next priming query."
[5] "it was triggered by a change to one of our database systems' permissions which caused the database to output multiple entries into a feature file used by our Bot Management system.""The issue was not caused, directly or indirectly, by a cyber attack or malicious activity of any kind.""Core traffic was largely flowing as normal by 14:30.""As of 17:06 all systems at Cloudflare were functioning as normal.""Given Cloudflare's importance in the Internet ecosystem any outage of any of our systems is unacceptable."
[6] "Cloudflare was hit by an outage that knocked several major websites and services offline for several hours.""OpenAI's ChatGPT, e-commerce platform Shopify and Elon Musk's social media platform X were among the sites impacted by the Cloudflare issues.""Cloudflare's software is used by many businesses worldwide, helping to manage and secure traffic for about 20% of the web."
[7] "Quad9 is the only large DNS resolver with a founding charter that includes privacy as a primary goal""The Quad9 DNS service is operated by the Swiss-based Quad9 Foundation, whose mission is to provide a safer and more robust Internet for everyone.""When your devices use Quad9 normally, no data containing your IP address is ever logged in any Quad9 system.""Quad9's organizational move to Switzerland is important for the free and open internet because it provides much-needed geographic and legal diversity in the open DNS resolver space."
[8] "The main difference between NextDNS and Cloudflare is that NextDNS offers more advanced privacy customization and parental controls, while Cloudflare emphasizes speed and global DNS performance.""NextDNS logs can be disabled entirely, while Cloudflare's 1.1.1.1 offers limited filtering features but faster response times globally."